I was trying to configure the forwarder for a while and couldn't succeed, therefore I was watching a video where the person told to make sure to have your status enabled. I thought that the reason that I am not receiving data could be that I might have it as disabled. Then I proceeded to enable everything on the manage apps section. Then I got the message that I needed to restart however the website couldn't automatically restart it by itself and told me to do it through the command line. I've searched for it but couldn't find it. I then decided to restart the pc, afterwards when I opened the website I got the message of "
127.0.0.1 refused to connect."
I then tried to stop and start the splunkd from the cmd with admin access but it didn't quite fix it either
Example of manage apps section (NOT MINE)
Hi @gcusello
Could you be able to help me out in this case. If there is no possibility to go back then I am planning to reinstall the splunk again. I am not sure if my Dashboards will be gone. Waiting to hear from you.
Hi @QuantumRgw ,
could you better describe your situation?
I understood that you have an Heavy Forwarder, but I don't know your requisites and your architecture.
Ciao.
Giuseppe
Hi @gcusello
Currently I can't open splunk. I believe the possible reason that this had happened is because I disabled/enabled some settings in the manage apps console. Right now I can't access any information because the website gives the "This site can’t be reached 127.0.0.1 refused to connect." information. How can I reconnect again
I will be waiting for your reply
Hi @QuantumRgw ,
I suppose that you don't remember what you disabled.
Anyway, check if the web interface is enabled at $SPLUNK_HOME/etc/system/local/web.conf.
Ciao.
Giuseppe
Hi @gcusello
I've checked the directory C:\Program Files\Splunk\etc\system\local\web.conf
This is how the file looks like, I believe since there isn't, it doesn't automatically start
Hi @gcusello
I've managed to edit the file and restart using thanks to your help. However, I have some problems as you can see in the image. Could you please provide me with the information that are essential to add to this file. Thanks
startwebserver = 1
[settings]
mgmtHostPort = 127.0.0.1:9997
Hi @QuantumRgw ,
this should be a different issue: it seems that there's a delay in search executions.
This could be caused by insufficient hardware resources or too many scheduled searches.
Wait for a while and see if this issue continue to be present.
Then analyze the load of your system using the Monitoring Console.
Ciao.
Giuseppe